jschoubben
b2e29871fd
`at` was settable. A node setting could point the builder's package binding at any host, and the builder sends its registry credential there as basic auth — so a setting meant for a port was a way to hand the password to somebody else. novox/hq 04-ISSUES/085
79 lines
2.1 KiB
JSON
79 lines
2.1 KiB
JSON
{
|
|
"module": "builder",
|
|
"version": "1",
|
|
"capabilities": [
|
|
"container-runtime"
|
|
],
|
|
"claims": [
|
|
{
|
|
"name": "the-build-machine",
|
|
"scope": "node"
|
|
}
|
|
],
|
|
"requires": [
|
|
"artifact-store"
|
|
],
|
|
"emits": [
|
|
"module.builder.built"
|
|
],
|
|
"own-secrets": {
|
|
"broker": "/var/lib/mesh/builder/broker",
|
|
"npm-password": "/var/lib/mesh/builder/npm-password"
|
|
},
|
|
"resources": [
|
|
{
|
|
"id": "mesh-state",
|
|
"type": "directory",
|
|
"path": "/var/lib/mesh/builder",
|
|
"mode": "0700"
|
|
},
|
|
{
|
|
"id": "workspace",
|
|
"type": "directory",
|
|
"path": "/var/lib/builder/workspace",
|
|
"mode": "0700"
|
|
},
|
|
{
|
|
"id": "builder-env",
|
|
"type": "file",
|
|
"path": "/var/lib/mesh/builder/builder.env",
|
|
"mode": "0600",
|
|
"content": "MESH_BROKER_FILE=/run/mesh/broker\nMESH_NODE=${machine:name}\nMESH_REGISTRY=${bound:artifact-store:at}:${bound:artifact-store:port}\nMESH_PACKAGE_BINDING=/run/mesh/package-registry.json\nMESH_NPM_TOKEN_FILE=/run/mesh/npm-password\nMESH_WORKSPACE=/var/lib/builder/workspace\n"
|
|
},
|
|
{
|
|
"id": "package-binding",
|
|
"type": "file",
|
|
"path": "/var/lib/mesh/builder/package-registry.json",
|
|
"mode": "0600",
|
|
"merge": "json",
|
|
"protected": [
|
|
"provision",
|
|
"from",
|
|
"at",
|
|
"as"
|
|
],
|
|
"content": "{\"provision\": \"package-registry\", \"from\": \"gitea\", \"at\": \"127.0.0.1\", \"as\": \"mesh-builder\", \"serves\": {\"scheme\": \"http\", \"port\": 3000, \"npm-path\": \"/api/packages/novox/npm/\"}}\n"
|
|
},
|
|
{
|
|
"id": "server",
|
|
"type": "container",
|
|
"name": "mesh-builder",
|
|
"image": "mesh-builder@sha256:0000000000000000000000000000000000000000000000000000000000000000",
|
|
"env-file": [
|
|
"/var/lib/mesh/builder/builder.env"
|
|
],
|
|
"volumes": [
|
|
"/var/lib/mesh/builder:/run/mesh:ro",
|
|
"/var/lib/builder/workspace:/var/lib/builder/workspace",
|
|
"/var/run/docker.sock:/var/run/docker.sock"
|
|
],
|
|
"restart-on": [
|
|
"builder-env",
|
|
"package-binding",
|
|
"needs-npm-password"
|
|
],
|
|
"network": "host"
|
|
}
|
|
]
|
|
}
|